Data Processing Agreement

1. Scope and Purpose

This Data Processing Agreement (“DPA”) supplements the Terms of Service between Mighty Maverick LLC (“Processor”) and the Customer (“Controller”) regarding the processing of personal data through the MightyKey.ai platform.

The Processor processes personal data on behalf of the Controller to provide the MightyKey.ai services, including AI agent execution, project management, and business automation.

2. Categories of Data

• Account Data: Name, email, authentication credentials
• Organization Data: Company name, team members, settings
• Project Data: Code, configurations, deployment artifacts, database schemas
• Agent Run Data: Requests, events, approvals, audit logs
• Usage Data: Token counts, costs, model usage, timestamps
• Technical Data: IP addresses, device info, session tokens

3. Sub-Processors

The Processor uses the following sub-processors to deliver the Service:

The Controller will be notified of any changes to sub-processors at least 30 days in advance.

4. Security Measures

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Credential isolation via Phantom Token pattern
• Immutable audit logging for all data access
• Role-based access control (RBAC)
• Regular vulnerability assessments
• Incident response procedures (notification within 72 hours)
• Employee access controls and training

5. Data Subject Rights

The Processor will assist the Controller in fulfilling data subject requests including: access, rectification, erasure, portability, restriction, and objection. Requests will be responded to within 30 days.

6. Data Retention and Deletion

Upon termination of the agreement, the Processor will delete all personal data within 30 days, unless retention is required by law. The Controller may export their data at any time during the active agreement period.

7. International Transfers

All primary data processing occurs in the United States. For transfers outside the US, the Processor relies on Standard Contractual Clauses (SCCs) as approved by the European Commission.

8. Audits

The Controller may request an audit of the Processor's data processing activities once per year, with 30 days' notice. The Processor will provide relevant documentation and cooperate with reasonable audit requests.

9. Contact

For DPA inquiries: dpa@mightykey.ai